./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor1375543383 <...> Warning: Permanently added '10.128.0.76' (ECDSA) to the list of known hosts. execve("./syz-executor1375543383", ["./syz-executor1375543383"], 0x7ffd901806f0 /* 10 vars */) = 0 brk(NULL) = 0x555556c54000 brk(0x555556c54c40) = 0x555556c54c40 arch_prctl(ARCH_SET_FS, 0x555556c54300) = 0 uname({sysname="Linux", nodename="syzkaller", ...}) = 0 readlink("/proc/self/exe", "/root/syz-executor1375543383", 4096) = 28 brk(0x555556c75c40) = 0x555556c75c40 brk(0x555556c76000) = 0x555556c76000 mprotect(0x7f20a31a1000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 unshare(CLONE_NEWPID) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5082 attached , child_tidptr=0x555556c545d0) = 5082 [pid 5082] mount(NULL, "/sys/fs/fuse/connections", "fusectl", 0, NULL) = -1 EBUSY (Device or resource busy) [pid 5082] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5082] setsid() = 1 [pid 5082] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0 [pid 5082] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0 [pid 5082] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0 [pid 5082] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0 [pid 5082] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, NULL) = 0 [pid 5082] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0 [pid 5082] unshare(CLONE_NEWNS) = 0 [pid 5082] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0 [pid 5082] unshare(CLONE_NEWIPC) = 0 [pid 5082] unshare(CLONE_NEWCGROUP) = 0 [pid 5082] unshare(CLONE_NEWUTS) = 0 [pid 5082] unshare(CLONE_SYSVSEM) = 0 [pid 5082] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = 3 [pid 5082] write(3, "16777216", 8) = 8 [pid 5082] close(3) = 0 [pid 5082] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = 3 [pid 5082] write(3, "536870912", 9) = 9 [pid 5082] close(3) = 0 [pid 5082] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC) = 3 [pid 5082] write(3, "1024", 4) = 4 [pid 5082] close(3) = 0 [pid 5082] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = 3 [pid 5082] write(3, "8192", 4) = 4 [pid 5082] close(3) = 0 [pid 5082] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = 3 [pid 5082] write(3, "1024", 4) = 4 [pid 5082] close(3) = 0 [pid 5082] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = 3 [pid 5082] write(3, "1024", 4) = 4 [pid 5082] close(3) = 0 [pid 5082] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = 3 [pid 5082] write(3, "1024 1048576 500 1024", 21) = 21 [pid 5082] close(3) = 0 [pid 5082] getpid() = 1 [pid 5082] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1< [ 60.924374][ T5082] dump_stack_lvl+0xd1/0x138 [ 60.928968][ T5082] print_report+0x15e/0x45d [ 60.933468][ T5082] ? __phys_addr+0xc8/0x140 [ 60.937975][ T5082] ? hfsplus_release_folio+0x554/0x5f0 [ 60.943458][ T5082] kasan_report+0xc0/0xf0 [ 60.947781][ T5082] ? hfsplus_release_folio+0x554/0x5f0 [ 60.953235][ T5082] hfsplus_release_folio+0x554/0x5f0 [ 60.958513][ T5082] ? hfsplus_show_options+0x670/0x670 [ 60.963882][ T5082] filemap_release_folio+0x13f/0x1b0 [ 60.969157][ T5082] block_invalidate_folio+0x4dc/0x5e0 [ 60.974526][ T5082] ? end_buffer_write_sync+0xf0/0xf0 [ 60.979800][ T5082] ? end_buffer_write_sync+0xf0/0xf0 [ 60.985076][ T5082] truncate_cleanup_folio+0x31a/0x3f0 [ 60.990443][ T5082] truncate_inode_pages_range+0x238/0xec0 [ 60.996158][ T5082] ? truncate_inode_partial_folio+0x760/0x760 [ 61.002218][ T5082] ? lock_chain_count+0x20/0x20 [ 61.007065][ T5082] ? lockdep_hardirqs_on_prepare+0x410/0x410 [ 61.013033][ T5082] ? rwlock_bug.part.0+0x90/0x90 [ 61.017970][ T5082] ? find_held_lock+0x2d/0x110 [ 61.022752][ T5082] ? truncate_inode_pages_final+0x63/0x90 [ 61.028466][ T5082] ? mark_held_locks+0x9f/0xe0 [ 61.033215][ T5082] ? rwlock_bug.part.0+0x90/0x90 [ 61.038142][ T5082] ? _raw_spin_unlock_irq+0x23/0x50 [ 61.043334][ T5082] ? lockdep_hardirqs_on+0x7d/0x100 [ 61.048524][ T5082] hfsplus_evict_inode+0x1a/0xe0 [ 61.053479][ T5082] ? hfsplus_remount+0x300/0x300 [ 61.058429][ T5082] evict+0x2ed/0x6b0 [ 61.062327][ T5082] iput+0x52b/0x8e0 [ 61.066131][ T5082] hfsplus_put_super+0x274/0x3f0 [ 61.071060][ T5082] ? hfsplus_sync_fs+0xb10/0xb10 [ 61.075989][ T5082] generic_shutdown_super+0x158/0x410 [ 61.081361][ T5082] kill_block_super+0x9b/0xf0 [ 61.086032][ T5082] deactivate_locked_super+0x98/0x160 [ 61.091399][ T5082] deactivate_super+0xb1/0xd0 [ 61.096078][ T5082] cleanup_mnt+0x2ae/0x3d0 [ 61.100486][ T5082] task_work_run+0x16f/0x270 [ 61.105072][ T5082] ? task_work_cancel+0x30/0x30 [ 61.109918][ T5082] do_exit+0xb17/0x2a90 [ 61.114072][ T5082] ? lock_downgrade+0x6e0/0x6e0 [ 61.118911][ T5082] ? do_raw_spin_lock+0x124/0x2b0 [ 61.123925][ T5082] ? mm_update_next_owner+0x7b0/0x7b0 [ 61.129293][ T5082] ? rwlock_bug.part.0+0x90/0x90 [ 61.134220][ T5082] ? _raw_spin_unlock_irq+0x23/0x50 [ 61.139421][ T5082] do_group_exit+0xd4/0x2a0 [ 61.143922][ T5082] __x64_sys_exit_group+0x3e/0x50 [ 61.148936][ T5082] do_syscall_64+0x39/0xb0 [ 61.153345][ T5082] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 61.159233][ T5082] RIP: 0033:0x7f20a31319a9 [ 61.163636][ T5082] Code: Unable to access opcode bytes at 0x7f20a313197f. [ 61.170635][ T5082] RSP: 002b:00007ffcfcabeea8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 61.179034][ T5082] RAX: ffffffffffffffda RBX: 00007f20a31a7330 RCX: 00007f20a31319a9 [ 61.186993][ T5082] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000001 [ 61.194948][ T5082] RBP: 0000000000000001 R08: ffffffffffffffc0 R09: 00000000000005f2 [ 61.202905][ T5082] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f20a31a7330 [ 61.210874][ T5082] R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000001 [ 61.218855][ T5082] [ 61.221858][ T5082] [ 61.224164][ T5082] Allocated by task 5082: [ 61.228470][ T5082] kasan_save_stack+0x22/0x40 [ 61.233144][ T5082] kasan_set_track+0x25/0x30 [ 61.237720][ T5082] __kasan_kmalloc+0xa2/0xb0 [ 61.242294][ T5082] hfsplus_btree_open+0x52/0xcd0 [ 61.247224][ T5082] hfsplus_fill_super+0xae5/0x1a30 [ 61.252332][ T5082] mount_bdev+0x351/0x410 [ 61.256652][ T5082] legacy_get_tree+0x109/0x220 [ 61.261411][ T5082] vfs_get_tree+0x8d/0x2f0 [ 61.265817][ T5082] path_mount+0x132a/0x1e20 [ 61.270309][ T5082] __x64_sys_mount+0x283/0x300 [ 61.275066][ T5082] do_syscall_64+0x39/0xb0 [ 61.279468][ T5082] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 61.285351][ T5082] [ 61.287683][ T5082] Freed by task 5082: [ 61.291642][ T5082] kasan_save_stack+0x22/0x40 [ 61.296306][ T5082] kasan_set_track+0x25/0x30 [ 61.300888][ T5082] kasan_save_free_info+0x2e/0x40 [ 61.305902][ T5082] ____kasan_slab_free+0x160/0x1c0 [ 61.311000][ T5082] slab_free_freelist_hook+0x8b/0x1c0 [ 61.316355][ T5082] __kmem_cache_free+0xaf/0x2d0 [ 61.321207][ T5082] hfsplus_btree_close+0x1e5/0x380 [ 61.326327][ T5082] hfsplus_put_super+0x224/0x3f0 [ 61.331274][ T5082] generic_shutdown_super+0x158/0x410 [ 61.336664][ T5082] kill_block_super+0x9b/0xf0 [ 61.341348][ T5082] deactivate_locked_super+0x98/0x160 [ 61.346727][ T5082] deactivate_super+0xb1/0xd0 [ 61.351409][ T5082] cleanup_mnt+0x2ae/0x3d0 [ 61.355817][ T5082] task_work_run+0x16f/0x270 [ 61.360399][ T5082] do_exit+0xb17/0x2a90 [ 61.364547][ T5082] do_group_exit+0xd4/0x2a0 [ 61.369061][ T5082] __x64_sys_exit_group+0x3e/0x50 [ 61.374089][ T5082] do_syscall_64+0x39/0xb0 [ 61.378501][ T5082] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 61.384395][ T5082] [ 61.386709][ T5082] The buggy address belongs to the object at ffff88801dcfa000 [ 61.386709][ T5082] which belongs to the cache kmalloc-4k of size 4096 [ 61.400753][ T5082] The buggy address is located 56 bytes inside of [ 61.400753][ T5082] 4096-byte region [ffff88801dcfa000, ffff88801dcfb000) [ 61.414024][ T5082] [ 61.416330][ T5082] The buggy address belongs to the physical page: [ 61.422724][ T5082] page:ffffea0000773e00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1dcf8 [ 61.432863][ T5082] head:ffffea0000773e00 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 61.441779][ T5082] flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff) [ 61.449762][ T5082] raw: 00fff00000010200 ffff888012442140 dead000000000122 0000000000000000 [ 61.458345][ T5082] raw: 0000000000000000 0000000000040004 00000001ffffffff 0000000000000000 [ 61.466925][ T5082] page dumped because: kasan: bad access detected [ 61.473326][ T5082] page_owner tracks the page as allocated [ 61.479023][ T5082] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 5082, tgid 5082 (syz-executor137), ts 60847014162, free_ts 54704496280 [ 61.502020][ T5082] get_page_from_freelist+0x11bb/0x2d50 [ 61.507566][ T5082] __alloc_pages+0x1cb/0x5c0 [ 61.512147][ T5082] alloc_pages+0x1aa/0x270 [ 61.516556][ T5082] allocate_slab+0x25f/0x350 [ 61.521144][ T5082] ___slab_alloc+0xa91/0x1400 [ 61.525821][ T5082] __slab_alloc.constprop.0+0x56/0xa0 [ 61.531192][ T5082] __kmem_cache_alloc_node+0x136/0x330 [ 61.536641][ T5082] kmalloc_trace+0x26/0x60 [ 61.541050][ T5082] alloc_super+0x52/0xb60 [ 61.545372][ T5082] sget+0x114/0x580 [ 61.549174][ T5082] mount_bdev+0xfc/0x410 [ 61.553409][ T5082] legacy_get_tree+0x109/0x220 [ 61.558168][ T5082] vfs_get_tree+0x8d/0x2f0 [ 61.562579][ T5082] path_mount+0x132a/0x1e20 [ 61.567073][ T5082] __x64_sys_mount+0x283/0x300 [ 61.571830][ T5082] do_syscall_64+0x39/0xb0 [ 61.576251][ T5082] page last free stack trace: [ 61.580914][ T5082] free_pcp_prepare+0x4d0/0x910 [ 61.585767][ T5082] free_unref_page+0x1d/0x490 [ 61.590446][ T5082] __folio_put+0x109/0x140 [ 61.594851][ T5082] skb_release_data+0x522/0x870 [ 61.599695][ T5082] skb_attempt_defer_free+0x309/0x3f0 [ 61.605058][ T5082] tcp_recvmsg_locked+0x124e/0x22b0 [ 61.610248][ T5082] tcp_recvmsg+0x117/0x620 [ 61.614656][ T5082] inet_recvmsg+0x114/0x640 [ 61.619152][ T5082] sock_read_iter+0x348/0x480 [ 61.623818][ T5082] vfs_read+0x7fa/0x930 [ 61.627971][ T5082] ksys_read+0x1ec/0x250 [ 61.632220][ T5082] do_syscall_64+0x39/0xb0 [ 61.636626][ T5082] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 61.642518][ T5082] [ 61.644826][ T5082] Memory state around the buggy address: [ 61.650441][ T5082] ffff88801dcf9f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 61.658487][ T5082] ffff88801dcf9f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 61.666534][ T5082] >ffff88801dcfa000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 61.674663][ T5082] ^ [ 61.680536][ T5082] ffff88801dcfa080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 61.688670][ T5082] ffff88801dcfa100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 61.696715][ T5082] ================================================================== [ 61.705414][ T5082] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 61.712631][ T5082] CPU: 1 PID: 5082 Comm: syz-executor137 Not tainted 6.2.0-rc3-next-20230112-syzkaller #0 [ 61.722532][ T5082] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 61.732587][ T5082] Call Trace: [ 61.735873][ T5082] [ 61.738836][ T5082] dump_stack_lvl+0xd1/0x138 [ 61.743444][ T5082] panic+0x2cc/0x626 [ 61.747360][ T5082] ? panic_print_sys_info.part.0+0x112/0x112 [ 61.753449][ T5082] ? preempt_schedule_thunk+0x1a/0x20 [ 61.758847][ T5082] ? preempt_schedule_common+0x59/0xc0 [ 61.764324][ T5082] check_panic_on_warn.cold+0x19/0x35 [ 61.769718][ T5082] end_report.part.0+0x36/0x73 [ 61.774496][ T5082] ? hfsplus_release_folio+0x554/0x5f0 [ 61.779971][ T5082] kasan_report.cold+0xa/0xf [ 61.784572][ T5082] ? hfsplus_release_folio+0x554/0x5f0 [ 61.790050][ T5082] hfsplus_release_folio+0x554/0x5f0 [ 61.795355][ T5082] ? hfsplus_show_options+0x670/0x670 [ 61.800780][ T5082] filemap_release_folio+0x13f/0x1b0 [ 61.806527][ T5082] block_invalidate_folio+0x4dc/0x5e0 [ 61.812184][ T5082] ? end_buffer_write_sync+0xf0/0xf0 [ 61.817483][ T5082] ? end_buffer_write_sync+0xf0/0xf0 [ 61.822779][ T5082] truncate_cleanup_folio+0x31a/0x3f0 [ 61.828172][ T5082] truncate_inode_pages_range+0x238/0xec0 [ 61.833931][ T5082] ? truncate_inode_partial_folio+0x760/0x760 [ 61.840014][ T5082] ? lock_chain_count+0x20/0x20 [ 61.844877][ T5082] ? lockdep_hardirqs_on_prepare+0x410/0x410 [ 61.850891][ T5082] ? rwlock_bug.part.0+0x90/0x90 [ 61.855844][ T5082] ? find_held_lock+0x2d/0x110 [ 61.860628][ T5082] ? truncate_inode_pages_final+0x63/0x90 [ 61.866363][ T5082] ? mark_held_locks+0x9f/0xe0 [ 61.871149][ T5082] ? rwlock_bug.part.0+0x90/0x90 [ 61.876098][ T5082] ? _raw_spin_unlock_irq+0x23/0x50 [ 61.881317][ T5082] ? lockdep_hardirqs_on+0x7d/0x100 [ 61.886533][ T5082] hfsplus_evict_inode+0x1a/0xe0 [ 61.891483][ T5082] ? hfsplus_remount+0x300/0x300 [ 61.896435][ T5082] evict+0x2ed/0x6b0 [ 61.900352][ T5082] iput+0x52b/0x8e0 [ 61.904180][ T5082] hfsplus_put_super+0x274/0x3f0 [ 61.909132][ T5082] ? hfsplus_sync_fs+0xb10/0xb10 [ 61.914084][ T5082] generic_shutdown_super+0x158/0x410 [ 61.919475][ T5082] kill_block_super+0x9b/0xf0 [ 61.924168][ T5082] deactivate_locked_super+0x98/0x160 [ 61.929560][ T5082] deactivate_super+0xb1/0xd0 [ 61.934254][ T5082] cleanup_mnt+0x2ae/0x3d0 [ 61.938686][ T5082] task_work_run+0x16f/0x270 [ 61.943292][ T5082] ? task_work_cancel+0x30/0x30 [ 61.948165][ T5082] do_exit+0xb17/0x2a90 [ 61.952341][ T5082] ? lock_downgrade+0x6e0/0x6e0 [ 61.957198][ T5082] ? do_raw_spin_lock+0x124/0x2b0 [ 61.962231][ T5082] ? mm_update_next_owner+0x7b0/0x7b0 [ 61.967622][ T5082] ? rwlock_bug.part.0+0x90/0x90 [ 61.972570][ T5082] ? _raw_spin_unlock_irq+0x23/0x50 [ 61.977789][ T5082] do_group_exit+0xd4/0x2a0 [ 61.982319][ T5082] __x64_sys_exit_group+0x3e/0x50 [ 61.987346][ T5082] do_syscall_64+0x39/0xb0 [ 61.991771][ T5082] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 61.997685][ T5082] RIP: 0033:0x7f20a31319a9 [ 62.002101][ T5082] Code: Unable to access opcode bytes at 0x7f20a313197f. [ 62.009113][ T5082] RSP: 002b:00007ffcfcabeea8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 62.017531][ T5082] RAX: ffffffffffffffda RBX: 00007f20a31a7330 RCX: 00007f20a31319a9 [ 62.025506][ T5082] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000001 [ 62.033476][ T5082] RBP: 0000000000000001 R08: ffffffffffffffc0 R09: 00000000000005f2 [ 62.041450][ T5082] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f20a31a7330 [ 62.049425][ T5082] R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000001 [ 62.057405][ T5082] [ 62.060580][ T5082] Kernel Offset: disabled [ 62.064900][ T5082] Rebooting in 86400 seconds..